Mobile health and privacy: cross sectional study

Gioacchino Tangari; Muhammad Ikram; Kiran Ijaz; Mohamed Ali Kaafar; Shlomo Berkovsky

doi:10.1136/bmj.n1248

Mobile health and privacy: cross sectional study

Gioacchino Tangari, Muhammad Ikram^*, Kiran Ijaz, Mohamed Ali Kaafar, Shlomo Berkovsky

^*Corresponding author for this work

Research output: Contribution to journal › Article › peer-review

84 Citations (Scopus)

89 Downloads (Pure)

Abstract

Objectives: To investigate whether and what user data are collected by health related mobile applications (mHealth apps), to characterise the privacy conduct of all the available mHealth apps on Google Play, and to gauge the associated risks to privacy.

Design: Cross sectional study

Setting: Health related apps developed for the Android mobile platform, available in the Google Play store in Australia and belonging to the medical and health and fitness categories.

Participants: Users of 20 991 mHealth apps (8074 medical and 12 917 health and fitness found in the Google Play store: In-depth analysis was done on 15 838 apps that did not require a download or subscription fee compared with 8468 baseline non-mHealth apps.

Main outcome measures: Primary outcomes were characterisation of the data collection operations in the apps code and of the data transmissions in the apps traffic; analysis of the primary recipients for each type of user data; presence of adverts and trackers in the app traffic; audit of the app privacy policy and compliance of the privacy conduct with the policy; and analysis of complaints in negative app reviews.

Results: 88.0% (n=18 472) of mHealth apps included code that could potentially collect user data. 3.9% (n=616) of apps transmitted user information in their traffic. Most data collection operations in apps code and data transmissions in apps traffic involved external service providers (third parties). The top 50 third parties were responsible for most of the data collection operations in app code and data transmissions in app traffic (68.0% (2140), collectively). 23.0% (724) of user data transmissions occurred on insecure communication protocols. 28.1% (5903) of apps provided no privacy policies, whereas 47.0% (1479) of user data transmissions complied with the privacy policy. 1.3% (3609) of user reviews raised concerns about privacy.

Conclusions: This analysis found serious problems with privacy and inconsistent privacy practices in mHealth apps. Clinicians should be aware of these and articulate them to patients when determining the benefits and risks of mHealth apps.

Original language	English
Article number	n1248
Pages (from-to)	1-12
Number of pages	12
Journal	The BMJ
Volume	373
DOIs	https://doi.org/10.1136/bmj.n1248
Publication status	Published - 2021

Bibliographical note

Version archived for private and non-commercial use with the permission of the author/s and according to publisher conditions. For further rights please contact the publisher.

Access to Document

10.1136/bmj.n1248

Publisher version (open access)Final published version, 984 KBLicence: CC BY-NC

Cite this

@article{6029b83b3f5140f0b57030e00633dd66,

title = "Mobile health and privacy: cross sectional study",

abstract = "Objectives: To investigate whether and what user data are collected by health related mobile applications (mHealth apps), to characterise the privacy conduct of all the available mHealth apps on Google Play, and to gauge the associated risks to privacy. Design: Cross sectional study Setting: Health related apps developed for the Android mobile platform, available in the Google Play store in Australia and belonging to the medical and health and fitness categories.Participants: Users of 20 991 mHealth apps (8074 medical and 12 917 health and fitness found in the Google Play store: In-depth analysis was done on 15 838 apps that did not require a download or subscription fee compared with 8468 baseline non-mHealth apps.Main outcome measures: Primary outcomes were characterisation of the data collection operations in the apps code and of the data transmissions in the apps traffic; analysis of the primary recipients for each type of user data; presence of adverts and trackers in the app traffic; audit of the app privacy policy and compliance of the privacy conduct with the policy; and analysis of complaints in negative app reviews. Results: 88.0% (n=18 472) of mHealth apps included code that could potentially collect user data. 3.9% (n=616) of apps transmitted user information in their traffic. Most data collection operations in apps code and data transmissions in apps traffic involved external service providers (third parties). The top 50 third parties were responsible for most of the data collection operations in app code and data transmissions in app traffic (68.0% (2140), collectively). 23.0% (724) of user data transmissions occurred on insecure communication protocols. 28.1% (5903) of apps provided no privacy policies, whereas 47.0% (1479) of user data transmissions complied with the privacy policy. 1.3% (3609) of user reviews raised concerns about privacy. Conclusions: This analysis found serious problems with privacy and inconsistent privacy practices in mHealth apps. Clinicians should be aware of these and articulate them to patients when determining the benefits and risks of mHealth apps.",

author = "Gioacchino Tangari and Muhammad Ikram and Kiran Ijaz and Kaafar, {Mohamed Ali} and Shlomo Berkovsky",

note = "Version archived for private and non-commercial use with the permission of the author/s and according to publisher conditions. For further rights please contact the publisher.",

year = "2021",

doi = "10.1136/bmj.n1248",

language = "English",

volume = "373",

pages = "1--12",

journal = "The BMJ",

issn = "0959-535X",

publisher = "BMJ Publishing Group",

}

TY - JOUR

T1 - Mobile health and privacy

T2 - cross sectional study

AU - Tangari, Gioacchino

AU - Ikram, Muhammad

AU - Ijaz, Kiran

AU - Kaafar, Mohamed Ali

AU - Berkovsky, Shlomo

N1 - Version archived for private and non-commercial use with the permission of the author/s and according to publisher conditions. For further rights please contact the publisher.

PY - 2021

Y1 - 2021

N2 - Objectives: To investigate whether and what user data are collected by health related mobile applications (mHealth apps), to characterise the privacy conduct of all the available mHealth apps on Google Play, and to gauge the associated risks to privacy. Design: Cross sectional study Setting: Health related apps developed for the Android mobile platform, available in the Google Play store in Australia and belonging to the medical and health and fitness categories.Participants: Users of 20 991 mHealth apps (8074 medical and 12 917 health and fitness found in the Google Play store: In-depth analysis was done on 15 838 apps that did not require a download or subscription fee compared with 8468 baseline non-mHealth apps.Main outcome measures: Primary outcomes were characterisation of the data collection operations in the apps code and of the data transmissions in the apps traffic; analysis of the primary recipients for each type of user data; presence of adverts and trackers in the app traffic; audit of the app privacy policy and compliance of the privacy conduct with the policy; and analysis of complaints in negative app reviews. Results: 88.0% (n=18 472) of mHealth apps included code that could potentially collect user data. 3.9% (n=616) of apps transmitted user information in their traffic. Most data collection operations in apps code and data transmissions in apps traffic involved external service providers (third parties). The top 50 third parties were responsible for most of the data collection operations in app code and data transmissions in app traffic (68.0% (2140), collectively). 23.0% (724) of user data transmissions occurred on insecure communication protocols. 28.1% (5903) of apps provided no privacy policies, whereas 47.0% (1479) of user data transmissions complied with the privacy policy. 1.3% (3609) of user reviews raised concerns about privacy. Conclusions: This analysis found serious problems with privacy and inconsistent privacy practices in mHealth apps. Clinicians should be aware of these and articulate them to patients when determining the benefits and risks of mHealth apps.

AB - Objectives: To investigate whether and what user data are collected by health related mobile applications (mHealth apps), to characterise the privacy conduct of all the available mHealth apps on Google Play, and to gauge the associated risks to privacy. Design: Cross sectional study Setting: Health related apps developed for the Android mobile platform, available in the Google Play store in Australia and belonging to the medical and health and fitness categories.Participants: Users of 20 991 mHealth apps (8074 medical and 12 917 health and fitness found in the Google Play store: In-depth analysis was done on 15 838 apps that did not require a download or subscription fee compared with 8468 baseline non-mHealth apps.Main outcome measures: Primary outcomes were characterisation of the data collection operations in the apps code and of the data transmissions in the apps traffic; analysis of the primary recipients for each type of user data; presence of adverts and trackers in the app traffic; audit of the app privacy policy and compliance of the privacy conduct with the policy; and analysis of complaints in negative app reviews. Results: 88.0% (n=18 472) of mHealth apps included code that could potentially collect user data. 3.9% (n=616) of apps transmitted user information in their traffic. Most data collection operations in apps code and data transmissions in apps traffic involved external service providers (third parties). The top 50 third parties were responsible for most of the data collection operations in app code and data transmissions in app traffic (68.0% (2140), collectively). 23.0% (724) of user data transmissions occurred on insecure communication protocols. 28.1% (5903) of apps provided no privacy policies, whereas 47.0% (1479) of user data transmissions complied with the privacy policy. 1.3% (3609) of user reviews raised concerns about privacy. Conclusions: This analysis found serious problems with privacy and inconsistent privacy practices in mHealth apps. Clinicians should be aware of these and articulate them to patients when determining the benefits and risks of mHealth apps.

UR - http://www.scopus.com/inward/record.url?scp=85108179281&partnerID=8YFLogxK

UR - http://purl.org/au-research/grants/nhmrc/1134919

U2 - 10.1136/bmj.n1248

DO - 10.1136/bmj.n1248

M3 - Article

C2 - 34135009

AN - SCOPUS:85108179281

SN - 0959-535X

VL - 373

SP - 1

EP - 12

JO - The BMJ

JF - The BMJ

M1 - n1248

ER -

Mobile health and privacy: cross sectional study

Abstract

Bibliographical note

Access to Document

Other files and links

Fingerprint

Centre of Research Excellence in Digital Health (CREDiH)

The privacy of health applications in the spotlight: where does our data go?

Nine out of 10 health apps harvest user data, global study shows

Cite this

Mobile health and privacy: cross sectional study

Abstract

Bibliographical note

Access to Document

Other files and links

Fingerprint

Projects

Centre of Research Excellence in Digital Health (CREDiH)

Press/Media

The privacy of health applications in the spotlight: where does our data go?

Nine out of 10 health apps harvest user data, global study shows

Cite this